Files

Ankur Mhatre e9381dc5be Add Spring Authorization Server project: OAuth2/OIDC provider, client and resource server

Three modules on Spring Boot 4.1.1 with Spring Authorization Server 7.1.1: the provider
itself, a relying party, and an API that trusts its tokens. Client registration, PKCE,
a custom consent page and token customisation, with profiles that make each failure
reproducible.

Every claim is backed by captured output in docs/output/as-*.txt, regenerated by
authorization-server/scripts/run-all.sh. Notable findings, verified against the jars:

  - OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(HttpSecurity) was deleted
    in 7.0, and both configuration classes moved into spring-security-config
  - ClientSettings.requireProofKey flipped from false to true, on the authorization server
    (1.5.8 -> 7.1.1) and on the OAuth2 client (6.5.1 -> 7.1.1)
  - requireProofKey(false) does not make PKCE optional for a public client; the code
    verifier is that client's only authentication at the token endpoint
  - MediaTypeRequestMatcher(TEXT_HTML) matches Accept: */*, so the token endpoint answers
    API callers with 302 -> /login unless setIgnoredMediaTypes(ALL) is called

Also renames the repository to spring-auth-demo and cross-links the new chapter set from
the existing documentation.

2026-08-24 08:20:38 +05:30

3.6 KiB

Raw Blame History

← index · next: 02 — The minimum working provider

Versions, artifacts and the 7.0 move

There is no Spring Authorization Server version to pin

The brief for this project was “pin the SAS version from the Boot 4.1 BOM”. There is nothing to pin. spring-boot-dependencies:4.1.1 has no <spring-authorization-server.version> property, because Spring Authorization Server is no longer a separate project.

$ grep -oP '<spring-security\.version>[^<]+' spring-boot-dependencies-4.1.1.pom
<spring-security.version>7.1.1

$ curl -s .../spring-security-bom/7.1.1/spring-security-bom-7.1.1.pom | grep -A1 authorization-server
        <artifactId>spring-security-oauth2-authorization-server</artifactId>
        <version>7.1.1</version>

The Maven coordinates are unchanged — org.springframework.security:spring-security-oauth2-authorization-server — and the version now tracks Spring Security. Spring Boot 4.1.1 therefore gives you 7.1.1.

The version numbers skipped

The published version list on Maven Central tells the story on its own:

… 1.5.6  1.5.7  1.5.8  2.0.0-M1  2.0.0-M2  7.0.0-M3  7.0.0-RC1 … 7.0.0  7.0.1 … 7.1.1  7.2.0-M1

2.0.0 was started and abandoned. There is no 2.x GA, and anything that tells you to upgrade to Spring Authorization Server 2 is describing a milestone that was renumbered. The line jumps from 1.5.8 to 7.0.0 to align with Spring Security 7.0.

Joe Grandja's announcement (11 September 2025) says the migration impact is “quite minimal” with “a couple of minor package relocation changes”. That is true in the sense that the relocations are mechanical. It is optimistic in the sense that one of them is the class every tutorial calls — see 02.

Which starter

Boot 4.1 publishes both of these, and they resolve the same four dependencies:

artifact	status
`spring-boot-starter-oauth2-authorization-server`	deprecated
`spring-boot-starter-security-oauth2-authorization-server`	current

That is not inference. It is in the deprecated starter's own published POM:

<description>Starter for using Spring Authorization Server features (deprecated in favor
 of spring-boot-starter-security-oauth2-authorization-server)</description>

The same rename happened to the client and resource-server starters (spring-boot-starter-security-oauth2-client, spring-boot-starter-security-oauth2-resource-server), and there is a new spring-boot-starter-security-oauth2-authorization-server-test. Boot 4 also renamed spring-boot-starter-web to spring-boot-starter-webmvc; the authorization server starter pulls the latter in transitively, so you do not need to declare a web starter at all.

Exact versions this project was built and run against


JDK	Temurin 25.0.4.1+1 (current LTS)
Spring Boot	4.1.1
Spring Framework	7.0.9
Spring Security / Authorization Server	7.1.1
Maven	3.9.11

Spring Security 7.1 JWT Authentication: The Complete Guide and docs/11-spring-security-7-changes.md — the rest of what moved in Spring Security 7
docs/output/as-settings-defaults.txt — defaults read out of the 1.5.8 and 7.1.1 jars side by side

Next: 02 — The minimum working provider

3.6 KiB Raw Blame History